@kustodian/plugin-doppler 1.0.0 → 1.1.0

package/README.md

@@ -0,0 +1,75 @@
+# @kustodian/plugin-doppler
+
+Doppler secret provider plugin for [Kustodian](https://github.com/lucasilverentand/kustodian). Enables seamless integration with [Doppler](https://www.doppler.com/) for secure secret management in your Kubernetes configurations.
+
+## Installation
+
+```bash
+bun add @kustodian/plugin-doppler
+```
+
+## Prerequisites
+
+- [Doppler CLI](https://docs.doppler.com/docs/install-cli) installed and available in your PATH
+- Authentication configured via `doppler login` or `DOPPLER_TOKEN` environment variable
+
+## Usage
+
+```typescript
+import { create_doppler_plugin } from '@kustodian/plugin-doppler';
+
+// Create with default options
+const plugin = create_doppler_plugin();
+
+// Or with custom options
+const plugin = create_doppler_plugin({
+  token: process.env.DOPPLER_TOKEN,  // Optional: override token
+  timeout: 30000,                     // Optional: CLI timeout in ms
+  fail_on_missing: true,              // Optional: fail if secrets are missing
+});
+```
+
+### CLI Commands
+
+The plugin provides CLI commands for working with Doppler:
+
+```bash
+# Check Doppler CLI availability
+kustodian doppler check
+
+# Test reading a secret
+kustodian doppler test <project> <config> <secret>
+
+# List available secrets in a config
+kustodian doppler list-secrets <project> <config>
+```
+
+### Programmatic API
+
+```typescript
+import {
+  check_doppler_available,
+  doppler_secret_get,
+  doppler_secrets_download,
+  resolve_doppler_substitutions,
+} from '@kustodian/plugin-doppler';
+
+// Check if Doppler CLI is available
+const available = await check_doppler_available();
+
+// Get a single secret
+const secret = await doppler_secret_get('my-project', 'production', 'API_KEY');
+
+// Download all secrets for a project/config
+const secrets = await doppler_secrets_download('my-project', 'production');
+
+// Resolve substitutions (batched by project/config for efficiency)
+const resolved = await resolve_doppler_substitutions([
+  { name: 'api_key', project: 'my-project', config: 'production', secret: 'API_KEY' },
+  { name: 'db_url', project: 'my-project', config: 'production', secret: 'DATABASE_URL' },
+]);
+```
+
+## License
+
+MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kustodian/plugin-doppler",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Doppler secret provider plugin for Kustodian",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,9 +37,9 @@
     "registry": "https://npm.pkg.github.com"
   },
   "dependencies": {
-    "@kustodian/core": "workspace:*",
-    "@kustodian/plugins": "workspace:*",
-    "@kustodian/schema": "workspace:*"
+    "@kustodian/core": "1.1.0",
+    "@kustodian/plugins": "1.0.1",
+    "@kustodian/schema": "1.3.0"
   },
   "devDependencies": {}
 }

package/src/executor.ts

@@ -120,7 +120,17 @@ export async function doppler_secrets_download(
 
   const result = await exec_command(
     'doppler',
-    ['secrets', 'download', '--project', project, '--config', config, '--format', 'json', '--no-file'],
+    [
+      'secrets',
+      'download',
+      '--project',
+      project,
+      '--config',
+      config,
+      '--format',
+      'json',
+      '--no-file',
+    ],
     {
       timeout,
       env,

package/src/plugin.ts

@@ -9,7 +9,11 @@ import type {
   PluginManifestType,
 } from '@kustodian/plugins';
 
-import { check_doppler_available, doppler_secret_get, doppler_secrets_download } from './executor.js';
+import {
+  check_doppler_available,
+  doppler_secret_get,
+  doppler_secrets_download,
+} from './executor.js';
 import type { DopplerPluginOptionsType } from './types.js';
 
 /**

package/src/resolver.ts

@@ -3,11 +3,16 @@ import type { KustodianErrorType } from '@kustodian/core';
 import type { DopplerSubstitutionType } from '@kustodian/schema';
 
 import { doppler_secrets_download } from './executor.js';
-import { create_cache_key, type DopplerCacheKeyType, type DopplerPluginOptionsType } from './types.js';
+import {
+  type DopplerCacheKeyType,
+  type DopplerPluginOptionsType,
+  create_cache_key,
+} from './types.js';
 
 /**
  * Resolves Doppler substitutions to actual secret values.
  * Groups by project/config to minimize API calls.
+ * Uses cluster-level defaults when project/config are not specified.
  * Returns a map from substitution name to resolved value.
  */
 export async function resolve_doppler_substitutions(
@@ -18,10 +23,31 @@ export async function resolve_doppler_substitutions(
     return success({});
   }
 
-  // Group substitutions by project/config to minimize API calls
-  const groups = new Map<DopplerCacheKeyType, DopplerSubstitutionType[]>();
+  // Validate and apply cluster defaults
+  const resolved_subs: Array<DopplerSubstitutionType & { project: string; config: string }> = [];
 
   for (const sub of substitutions) {
+    const project = sub.project ?? options.cluster_defaults?.project;
+    const config = sub.config ?? options.cluster_defaults?.config;
+
+    if (!project || !config) {
+      return failure({
+        code: 'MISSING_DOPPLER_CONFIG',
+        message: `Doppler substitution '${sub.name}' missing project/config and no cluster defaults configured`,
+      });
+    }
+
+    resolved_subs.push({
+      ...sub,
+      project,
+      config,
+    });
+  }
+
+  // Group substitutions by project/config to minimize API calls
+  const groups = new Map<DopplerCacheKeyType, typeof resolved_subs>();
+
+  for (const sub of resolved_subs) {
     const key = create_cache_key(sub.project, sub.config);
     const group = groups.get(key) ?? [];
     group.push(sub);
@@ -36,7 +62,10 @@ export async function resolve_doppler_substitutions(
   // Fetch secrets for each group
   for (const [key, subs] of groups) {
     // Get project and config from the first substitution in the group
-    const first = subs[0]!;
+    const first = subs[0];
+    if (!first) {
+      continue;
+    }
 
     // Check if we already have the secrets cached
     let secrets = secrets_cache.get(key);

package/src/types.ts

@@ -1,3 +1,13 @@
+/**
+ * Cluster-level Doppler defaults.
+ */
+export interface DopplerClusterDefaultsType {
+  /** Default project name */
+  project?: string | undefined;
+  /** Default config name */
+  config?: string | undefined;
+}
+
 /**
  * Options for the Doppler plugin.
  */
@@ -8,6 +18,8 @@ export interface DopplerPluginOptionsType {
   timeout?: number | undefined;
   /** Whether to fail on missing secrets (default: true) */
   fail_on_missing?: boolean | undefined;
+  /** Cluster-level defaults for project/config */
+  cluster_defaults?: DopplerClusterDefaultsType | undefined;
 }
 
 /**